GitHub Advisoryadvisory · npm

GHSA-45hw-29x7-9x95 Arbitrary File Read in Snyk Broker

MEDIUM Published 2020-06-03 Modified 2021-07-29 Official page ↗
Aliases
CVE-2020-7651
Ecosystem
npm
Packages
snyk-broker
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-01

Affected packages

• npm snyk-broker: < 4.79.0 → fixed in 4.79.0

Description

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.

Related

Alias · CVE (1)

  • CVE-2020-7651 All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References